CVE-2026-69590: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

CVE-2026-69590 PUBLISHED CVSS 9.8 CRITICAL

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Reported by microsoft · Published September 8, 2026

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

Risk scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	10.0.14393.0
Microsoft	Windows 10 Version 1809	10.0.17763.0
Microsoft	Windows 10 Version 21H2	10.0.19044.0
Microsoft	Windows 10 Version 22H2	10.0.19045.0
Microsoft	Windows 11 version 23H2	10.0.22631.0
Microsoft	Windows 11 Version 23H2	10.0.22631.0
Microsoft	Windows 11 Version 24H2	10.0.26100.0
Microsoft	Windows 11 Version 25H2	10.0.26200.0
Microsoft	Windows 11 version 26H1	10.0.28000.0
Microsoft	Windows Server 2012	6.2.9200.0
Microsoft	Windows Server 2012 (Server Core installation)	6.2.9200.0
Microsoft	Windows Server 2012 R2	6.3.9600.0
Microsoft	Windows Server 2012 R2 (Server Core installation)	6.3.9600.0
Microsoft	Windows Server 2016	10.0.14393.0
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0
Microsoft	Windows Server 2019	10.0.17763.0
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0
Microsoft	Windows Server 2022	10.0.20348.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0

…and 34 more

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-69590
vulnetix vdb fixes CVE-2026-69590

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-69590/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart